Azuracast Before 0.23.8 Dql Injection Via Sortorder

Back www.vulncheck.com

Azuracast Before 0.23.8 Dql Injection Via Sortorder

www.vulncheck.com • September 27, 2026

Share: View original

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

GitHub Security Advisory (GHSA-jqwc-h3rq-frmw)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

High-Risk Vulnerabilities Discovered in AzuraCast Two critical vulnerabilities (CVE-2026-100851 and CVE-2026-100847) were identified in AzuraCast versions prior to 0.23.8. CVE-2026-100851 allows authenticated users with minimal permissions to access sensitive admin credentials through a broken access control flaw. CVE-2026-100847 enables attackers to exploit a DQL injection vulnerability to extract sensitive database information, including user credentials. Both vulnerabilities pose a high risk to self-hosted streaming platforms, especially those accessible over the internet. The exploitation status for both vulnerabilities remains unconfirmed, with no proof-of-concept or active exploitation reported. Administrators are urged to upgrade to the patched version promptly and review access logs for suspicious activity. The vulnerabilities were published on September 27, 2026. 2 sources 58

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

CWE-89 - SQL Injection